The kimipooh List View Google Calendar plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input in event descriptions. This affects all versions up to and including 7.4.3. The flaw allows authenticated users with administrator privileges to inject arbitrary scripts that execute when other users access the injected pages. This vulnerability specifically impacts multi-site WordPress installations or those where the unfiltered_html capability is disabled. The CVSS 3.1 base score is 4.4, reflecting a medium severity with network attack vector, high attack complexity, and requiring high privileges but no user interaction. No vendor patch or official remediation has been published yet.

An attacker with administrator-level access on affected WordPress multi-site installations or installations with disabled unfiltered_html can inject malicious scripts into event descriptions. These scripts execute in the context of users viewing the injected pages, potentially leading to limited confidentiality and integrity impacts such as session hijacking or content manipulation. The vulnerability does not affect availability and requires high privileges and a complex attack vector, limiting its exploitation scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator access to trusted users only and consider enabling unfiltered_html capability if feasible. Monitor plugin updates from the vendor and apply patches promptly once available.